zkemail / zk-email-verify

Verify any text in any sent or received email, cryptographically and via only trusting the sending mailserver.
https://prove.email
MIT License
361 stars 77 forks source link

Update of UserOverrideableDKIMRegistry #233

Closed SoraSuegami closed 1 week ago

SoraSuegami commented 2 weeks ago

Description

The current implementation of UserOverrideableDKIMRegistry only supports pessimistic key updates; i.e., each user's approval is always required to enable a new public key set by the main authorizer. This causes liveness issues when the user loses access to their account. However, a naive implementation for optimistic key updates, which enables a new public key set by the main authorizer without the user's approval immediately, has a safety issue when the main authority is invalid. To make it possible to balance this tradeoff, this PR introduces a time delay until the public key set by the main authorizer is enabled without the user's approval. Such a public key is enabled 1) after the time delay passes or 2) when the user approves the public key before the time delay passes. Therefore, the greater the delay becomes, the closer it approaches a pessimistic update, while the opposite brings it closer to an optimistic update.

Type of Change

Please delete options that are not relevant.

Checklist:

socket-security[bot] commented 2 weeks ago

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher

View full report↗︎